Why North Korea's 'elite' hackers are the prime suspect in major Binance hack

In this massive theft, where nearly $6.3 billion (£4.7 billion) vanished from Binance, two major blockchain analytics firms have presented strong evidence suggesting a state-sponsored group from North Korea is responsible.

The Lazarus Group, another name for the North Korean hacking unit TraderTraitor, has been identified "with high confidence" by both Chainalysis and TRM Labs. This latest event follows other incidents linked to the nation, a country characterized by severe internet restrictions and poverty. Experts maintain that the regime under North Korean leader Kim Jong Un utilizes cybercrime as a means of self-funding, a claim Pyongyang consistently refutes.

The nation's most notable suspected cyberattack, though not financial, occurred in 2014, targeting Sony Pictures after the studio produced the film The Interview, which featured a plot to assassinate Kim. That intrusion resulted in the leakage of numerous sensitive emails exchanged among the studio's senior management.

Regarding the recent Binance breach, the FBI previously declared that North Korea was behind the theft of $1.5 billion from the Bybit exchange last year. Following that occurrence, the agency reported that TraderTraitor swiftly moved to disperse and launder the compromised assets, converting them into Bitcoin and other digital assets with the ultimate aim of securing hard currency. The FBI has generally leveled accusations against North Korea concerning "illicit cybercrime and virtual asset theft activities."

Reports indicate that the country has methodically cultivated its cyber capabilities, directing the most promising university students into hacking collectives supervised by North Korea's intelligence agency. Furthermore, analysis from various technology groups suggests that some of this cyber warfare takes place just across the border in China.

Much of the hacking undertaken by these actors is motivated by financial gain. North Korean hackers are also implicated in the 2022 theft of $620 million in cryptocurrency. In that particular heist, agents from North Korea are alleged to have employed a specific authorization to transform a Binance hot wallet, which is connected to the internet, into one that would automatically transfer funds to the perpetrator. TRM suggested that the attacker likely managed to gain access to Binance's hot wallet signing system as part of the overall operation.

Binance has not provided a direct response to the BBC's inquiries concerning any possible connection of this incident to the region. Initially, the firm suggested that an engineer's laptop had been compromised, enabling unauthorized withdrawals, but later clarified that the attack was more extensive. Binance's co-CEO, Richard Teng, stated, "Our subsequent investigation has uncovered additional points of breach." While a Binance spokesperson mentioned on Friday that approximately 80% of the stolen assets have been recovered, the remaining portion remains untraced.

If these allegations prove accurate, this landmark robbery demonstrates the increasing potency of suspected North Korean hackers, signaling that the instruments of cybercrime have grown more sophisticated. Experts also point to the emergence of artificial intelligence as a factor providing threat actors with novel avenues for criminality through automation and other methods; in this specific instance, the use of AI to infiltrate Binance's infrastructure is considered plausible. Chainalysis noted that the attacker utilized laundering patterns "we have not seen before."